Med Spa Regulations by State: 2026 At-a-Glance Comparison

If you operate a med spa in more than one state — or you are choosing where to open your first — the single most expensive mistake is assuming the rules travel with you. They do not. A structure that is standard in Florida can be the unlicensed corporate practice of medicine in California, and an injector staffing model that works in Texas can collapse the moment you cross into a state that reads delegation more narrowly. The regulation of aesthetic medicine is state law, and state law diverges sharply. This page exists to make that divergence visible on one screen.

This is the comparison pillar for our 2026 state med spa regulatory profile series. We published a standardized, six-dimension profile for each of nine states, and this page is where they come together into a genuine side-by-side. It is deliberately not a rewrite of our med spa regulations by state reference, which is the deeper cross-category guide with primary sources; this is the comparison matrix — the at-a-glance grid that shows which states sit at which end of each dimension, and then hands you off to the full profile for your state. Use the two together: the matrix for orientation, the reference and profiles for the detail you build a program on.

Important: Regulations and enforcement priorities change frequently and vary by state. This comparison reflects the regulatory environment as of July 2026 and is educational, not legal advice. Verify with your state medical board, board of nursing, and a healthcare attorney before relying on any characterization here for a compliance decision.

The 2026 Med Spa Regulatory Landscape, State by State

A comparison like this is useful because med spa regulation has no single federal architecture. The FDA regulates devices and drugs, but who may own a med spa, who must supervise the medicine, and who may perform each treatment are answered almost entirely by state medical practice acts, nurse practice acts, and board rules. Those bodies were not coordinated, so the answers diverge, sometimes dramatically, at every state line.

That divergence is not random, though. Across dozens of states, the same recognizable patterns recur. A cluster of states enforces the corporate practice of medicine strictly; another lets non-physicians own the business outright. Some states treat firing a laser as the practice of medicine; others treat it as a delegable act with oversight. Once you see the patterns, a new state stops being a blank slate and becomes a question of which known pattern it follows on each dimension — exactly what a standardized profile series is built to surface, and what this matrix distills.

The nine states in this comparison were chosen because they are the largest aesthetic markets and, between them, illustrate the full spread of every pattern. Florida and Texas are the two biggest markets and sit at opposite ends of the ownership question; California, New York, and Illinois anchor the strict corporate-practice cluster; Georgia and Tennessee show the middle; and Arizona and Ohio show what genuinely permissive entry looks like. If you understand how these nine differ, you have a working map for reading any state you have not profiled yet.

The Comparison Matrix: 9 States × 6 Dimensions

Here is the whole series on one screen. Each row is a state; each column is one of the six standardized dimensions; each cell is the level that state was characterized at in its individual profile. The colors are a reading aid only — they shade toward the more-regulated end of each dimension in red, the middle in amber, and the more-permissive end in green — and they are not a score. Read across a row for the shape of one state; read down a column to see how the nine states differ on a single dimension.

A few things jump out of the grid immediately. No state is uniformly strict or uniformly permissive — every row is a mix, which is precisely why a single-number ranking would mislead. Ownership has the widest spread. Laser is the most consistent: seven of the nine states treat it as the practice of medicine. And enforcement does not track ownership — Florida is permissive to enter and active to police, the exact combination that catches unprepared operators. The sections below walk each column in turn.

The Frozen Rubric — How to Read Every Cell

The comparison only works because every state in the series was characterized against the identical rubric. Six dimensions, three levels each, defined once and applied the same way to every state, so that a level in Florida means the same thing as the same level in Illinois. If the columns meant different things in different profiles, the matrix would be nine unrelated essays in a grid. Freezing the rubric is what makes it a genuine comparison tool.

The Six Dimensions and Their Three Levels

Here is the rubric, verbatim, exactly as each state profile uses it. Ownership / CPOM runs Permissive, Moderate, or Strict — how hard the state makes it for a non-physician to own the clinical business. Medical director runs Not required, Required, or Required with real supervision mandated — whether a physician must stand behind the practice and how genuine that oversight must be. Injector scope runs Broad, Moderate, or Narrow — how widely the state lets a physician delegate injectable treatment. Laser classification runs Not the practice of medicine, Delegated with oversight, or Practice of medicine plus supervision. Registration / licensure runs None, Facility or health-care licensure, or Dedicated med-spa registration statute — what the state makes you file to operate. Enforcement posture runs Light, Moderate, or Active — how hard the regulator actually pushes once you are open.

Why a Level Is a Direction, Not a Grade

Each level is shorthand for which end of a spectrum a state sits on, not a mark out of three. Permissive is not a failing grade and Strict is not an honor; they describe the environment, and which one suits you depends on your model. A well-capitalized group building a physician-owned platform may find a strict-CPOM state comfortable, while a nurse-owned single location may find the same state impossible and a permissive state ideal. The levels tell you what environment you are walking into so you can decide whether it fits — not whether the state is good or bad. That is also why we group states into descriptive tiers rather than numbering them: the useful signal is the pattern, not a rank.

Descriptive Climate Tiers — Grouping the States

With the rubric fixed and the matrix in front of you, the natural next question is whether the nine states fall into recognizable groups. They do — three of them. We call these descriptive climate tiers, and the word descriptive is doing real work: these are characterizations of the overall regulatory environment, not a numbered leaderboard from one to nine. Two states in the same tier can still feel different to operate in, and the matrix above is where those differences live. The tiers are a way to orient, not a ranking to memorize.

Stricter States — California, New York, Illinois, and Texas

The stricter tier shares a spine: a strict corporate-practice-of-medicine posture and a medical director expected to provide real, documented supervision, paired with active enforcement. California, New York, and Illinois are the archetype — the clinical entity must be physician-owned, non-physicians reach the business through a management-services structure layered on top, laser and injectables are the practice of medicine, and regulators push. Texas belongs here too: it enforces CPOM aggressively and mandates genuine physician oversight, even though its injector delegation is comparatively broad. What unites the tier is that structure and supervision are not negotiable, and thin or absentee arrangements are where operators get caught. These are the states where a compliant build costs more up front and pays off by being defensible.

Moderate States — Georgia and Tennessee

The moderate tier sits between the two extremes without simply being an average of them. Georgia and Tennessee both expect real physician supervision and treat laser as the practice of medicine, but neither enforces the strict physician-ownership bar of the top tier, and both run enforcement at a moderate rather than active pitch. Tennessee is the more distinctive because it is the one state in the series with a dedicated med-spa registration statute — it treats medical spas as their own regulated category rather than folding them into general business or facility licensure. Georgia leans on a physician-delegation and protocol-agreement model. The practical read is that the medicine must be genuinely supervised, but the ownership structure has more give than in the stricter states, which makes these attractive for operators who want real clinical rigor without a full CPOM build.

More Permissive States — Florida, Arizona, and Ohio

The more permissive tier is defined by an easy front door: non-physician ownership is allowed, delegation is broad enough that RNs can inject under a physician order, and no strict CPOM bar forces a physician-owned entity. Arizona is the most permissive on entry in the series — it does not mandate a formal medical director, because a nurse practitioner with full practice authority can lead the clinical program outright. Ohio pairs permissive ownership with broad delegation and treats laser as delegable with oversight. Florida sits in this tier on structure but carries the series most important caveat: its enforcement posture is active, not moderate. Florida is the clearest proof that permissive and unwatched are different things — one of the easiest states to open a med spa and one of the more demanding to run one in. Permissive here means easy to enter, never free of obligation.

Ownership & Corporate Practice of Medicine Across States

Ownership is where the nine states diverge most, and it is usually the first question that decides whether a business plan is even possible in a state. The corporate practice of medicine (CPOM) doctrine holds that a licensed professional, not a corporation or a lay investor, must control clinical decisions. States that enforce it strictly require the medical side of a med spa to be owned by a physician-controlled entity; states that do not let non-physicians own the business directly. Everything downstream — how you raise capital, who sits on the cap table, whether you need a management-services organization — flows from where a state lands here.

The Strict-CPOM States

California, New York, Illinois, and Texas all enforce corporate practice strictly. In these states the clinical entity must be physician-owned, and a non-physician entrepreneur or investor reaches the business through a management-services-organization (MSO) arrangement layered on top of a physician-owned professional corporation. California has tightened this further, making explicit that a management company cannot control clinical decisions such as device selection and treatment parameters. The practical consequence is that a nurse-owned or investor-owned single location is not a viable structure for the medicine here without the MSO scaffolding, and building it correctly is a legal project, not a formality. Get it wrong and the entire operation can be characterized as the unlicensed corporate practice of medicine.

The Permissive-Ownership States

Florida, Arizona, and Ohio sit at the other end. In these states a non-physician — a registered nurse, a nurse practitioner, an esthetician, or a pure investor — can be the owner of record of the med spa business, which is a large part of why Florida leads the nation in med spa count. Georgia and Tennessee sit in the middle. The universal caveat, true even in the most permissive state, is that owning the business is not the same as holding clinical authority: a non-physician owner still cannot generate the treatment order, perform the good-faith exam, or supervise the medicine — a clinician must. The safe structure separates business ownership from the clinical chain of command and documents both, everywhere.

Medical Director Requirements Across States

If ownership is where the states diverge most, the medical director is where they converge most — with one telling exception. Because nearly everything a med spa sells is the practice of medicine, almost every state expects a physician standing behind the practice. What varies is how genuine that relationship must be — the difference between a bare requirement and a requirement that real, documented supervision actually occur.

Where Real Supervision Is Mandated

California, New York, Illinois, Texas, Georgia, and Tennessee all sit at the strongest level: a medical director is required and real supervision is mandated, not a signature from a distance. In these states an absentee or paper director — a physician who lends a name and never reviews a chart or sets foot in the building — is one of the most common findings that turns a routine complaint into a multi-board action. Florida and Ohio require the physician relationship but stop short of mandating hands-on supervision at every treatment, which is why they sit at the middle Required level. Everywhere, the direction of travel is toward genuine engagement: build the relationship as if real supervision were mandated, because that is where enforcement is heading.

The Outlier — No Formal Medical Director Required

Arizona is the single state in the series characterized as Not required, and the reason is structural rather than lax. Arizona grants nurse practitioners full practice authority, which means an NP can sit at the top of the clinical chain — performing the good-faith exam, ordering treatment, and supervising delegates — without a collaborating physician. So Arizona does not impose a formal medical-director requirement because it does not need to route authority through a physician. This is not the same as no oversight: the services are still the practice of medicine, and someone with the authority to practice it must own the clinical decisions. It simply means the person at the top of the chain can be an NP rather than an MD, which changes who you must recruit to open.

Injector Scope Across States

Injector scope describes how widely a state lets a physician delegate the actual injecting of neurotoxins and fillers. Operators feel it most directly in hiring and scheduling, because it determines whether a registered nurse can carry the injection load or whether the work concentrates in a smaller pool of clinicians. None of the nine states is characterized as Narrow, which reflects that injectables are broadly delegable across the modern aesthetics industry — but Broad and Moderate describe meaningfully different staffing realities.

The Broad-Delegation States

Florida, Texas, Arizona, Ohio, and Tennessee are the broad-delegation states, where an RN can inject under a physician order and operators have wide staffing latitude. Broad, however, is not boundless, and two limits recur. First, a good-faith exam by a physician, NP, or PA must precede treatment — the RN can perform the injection but generally cannot generate the treatment order from the exam. Second, the perennial myth that an injector certificate confers authority is false everywhere: authority flows from the physician relationship and the delegation behind it, never from a weekend course, and estheticians and unlicensed staff may never inject. Broad describes who can be delegated the task, not a relaxation of the medical chain of command behind it.

The Moderate-Scope States

California, New York, Georgia, and Illinois are characterized as Moderate — delegation is real but more constrained, with tighter expectations about who may inject and under what supervision. In practice the pool of acceptable injectors and the supervision paperwork are held to a higher standard than in the broad states. For a multi-state operator, the injector-scope column is a direct staffing-plan input: a model that leans heavily on RN injectors under thin supervision will run more smoothly in the broad states and needs a tighter, better-documented delegation structure in the moderate ones. It is one of the clearest examples of why the same operational playbook cannot be copied unchanged across state lines.

Laser Classification Across States

Laser is the most consistent dimension in the comparison, and the consistency is the headline: seven of the nine states treat firing an aesthetic laser as the practice of medicine. Energy-based devices deliver enough tissue effect that most states refuse to treat them as casual esthetic services, so laser almost always requires a supervising physician, operator credentials that match the state route, and device-specific protocols and training records. This is the dimension where the assumption that a certificate is enough gets the most operators into trouble.

Laser as the Practice of Medicine

Florida, California, New York, Georgia, Arizona, Illinois, and Tennessee all classify laser and energy-based treatments as medical acts requiring physician involvement and supervision. In these states you cannot staff laser casually: you need operators whose credentials actually match the state route, a physician supervision structure with documented responsibility, and per-device protocols and training files built before the first pass, not after a complaint. Treat laser in any of these states as one of the genuinely strict corners of the program regardless of how permissive the state is on ownership.

The Delegated-With-Oversight States

Texas and Ohio sit one notch lower, characterized as Delegated with oversight rather than pure practice of medicine. The distinction is real but narrow: these states still require a supervising physician and proper delegation, but they frame laser as an act that may be delegated to a trained operator under oversight rather than one reserved strictly to medicine. In practical terms there is somewhat more room for a trained, delegated operator, but the supervision structure and documentation obligations do not disappear. Nobody should read Delegated with oversight as permission to run a laser program without a physician; it is a slightly different legal frame around the same core requirement of physician-anchored oversight.

Registration & Licensure Across States

Registration answers a narrow but practical question: what does the state actually make you file to operate a med spa? The striking finding is how little most states require here, and how easy it is to misread that as evidence of light regulation. In most of the series, the clinical rules do the regulating and there is no med-spa-specific filing at all — a very different thing from being unregulated.

The Dedicated-Statute Outlier

Tennessee is the one state in the series with a dedicated med-spa registration statute — it treats medical spas as their own regulated category with a specific registration regime, rather than folding them into general business or facility licensure. That makes it the closest thing in the comparison to a state that has purpose-built a med-spa framework. For operators, a dedicated statute is in some ways easier to comply with because the requirements are named and specific rather than inferred from a general medical practice act, but it also means there is a concrete filing you cannot skip and a defined category you must fit inside.

Facility-Licensure vs. No-Registration States

Florida and Ohio fall into a middle group where med spas commonly slot into existing facility or health-care-clinic licensure rather than a med-spa-specific filing — in Florida, many practices register as Health Care Clinics, subject to case-by-case analysis and a designated clinic director. California, New York, Georgia, Arizona, and Illinois have no med-spa registration regime at all; you form an ordinary business entity and the ownership, supervision, and scope rules do the regulating. The critical point is that None in the registration column is not the same as light regulation. Several of the None states — California, New York, Illinois — are the strictest overall. The absence of a filing simply means the state controls med spas through its medical practice act rather than a registration desk, and that control is often tighter, not looser.

Enforcement Posture Across States

Enforcement is the dimension most likely to defy an operator expectation, because it does not track the others. A permissive rulebook does not mean a quiet regulator, and the clearest lesson of the comparison is that how easy a state is to enter tells you almost nothing about how closely it will watch you once you are open. Enforcement is where the paper you can produce on demand — not the severity of the statute — decides your outcome.

The Active-Enforcement States

Florida, Texas, California, New York, and Illinois are characterized as Active. For the strict-tier states this is unsurprising: strict structure and active enforcement go together. Florida is the instructive case, because it combines active enforcement with permissive ownership — the state that is easiest to open in is also one that inspects aggressively and pays close attention to who is actually performing treatments and under whose authority. Florida enforcement is heavily complaint-driven: it usually begins not with a scheduled audit but with a single patient complaint, a competitor tip, or an adverse event, from which an investigation can reach the injector, the medical director, and the facility at once. In active states, the documentation is the compliance.

The Moderate-Enforcement States

Georgia, Arizona, Ohio, and Tennessee are characterized as Moderate on enforcement — regulators are real and complaints are pursued, but the state is not running the aggressive, high-visibility posture of the active tier. Moderate is not an invitation to cut corners; it describes the current temperature, and temperatures rise. Several states in the series moved toward active enforcement after high-profile reporting on unsupervised procedures, and any moderate state can become an active one after a single publicized adverse event. The prudent read is to build as if it were active — keep the medical director relationship real, the delegation documented, and the charts complete — so that a shift in enforcement posture is a non-event rather than an emergency.

What This Means for Multi-State Operators

The whole point of a comparison like this is operational: if you run locations in more than one state, the matrix is a map of where your single playbook will and will not transfer. The dimensions that vary most — ownership and injector scope — are exactly the ones baked deepest into an operating model, which is why growth across state lines is where compliance debt tends to surface all at once.

The Compliance-Floor Strategy

The most durable approach for a multi-state group is to build to the strictest state you operate in and then relax deliberately where a state genuinely allows it — not the reverse. If your documentation, medical director engagement, and delegation structure would satisfy California or New York, they will satisfy Florida or Arizona, and you get one operating standard instead of a different one per location. Building to the permissive floor and scrambling to add rigor when you expand into a strict state is how groups end up with an unlicensed-corporate-practice problem they did not know they had. A single high compliance floor is cheaper to run than a patchwork. The MedSpa Standards SOP library exists precisely to give a multi-state operator one consistent, inspection-ready standard to customize per state rather than rebuilding from scratch each time.

Where the Traps Hide

The predictable traps live at the seams between dimensions. The ownership trap is assuming a structure that is standard in a permissive state is legal in a strict one — the single most expensive cross-state mistake. The enforcement trap is reading permissive entry as low risk and under-documenting in a state like Florida that is easy to enter and active to police. The injector trap is copying an RN-heavy staffing model from a broad-delegation state into a moderate one without tightening the supervision paperwork. And the registration trap is reading None as unregulated. Every one of these traps is visible in the matrix if you read across each state row rather than assuming the states resemble each other.

A Note on Methodology — Descriptive, Not Scored

Because this page invites comparison, it is worth being explicit about what it is and is not. Every state in the series is characterized on the same six dimensions, each with the same three levels, grounded in that state 2026 law and explained in full in the individual profile. What we deliberately do not do is assign a numeric score or rank the states one through nine. That restraint is a methodological choice, not a hedge.

Regulatory environments are not really rankable on a single axis. A state that is lenient on ownership but aggressive on enforcement does not reduce cleanly to a number, and forcing it to would destroy the exact information an operator needs — the shape of the state, not a scalar. A single score would also imply a precision the underlying law does not support. So we group states into descriptive climate tiers, shade the matrix toward the more-regulated end of each dimension, and stop there. Read the levels as a compass direction, not a grade point average. If you want the reasoning behind any single cell — why Florida is Permissive on ownership but Active on enforcement — the individual state profile is where it lives, one click away below.

State Regulatory Profiles — The Nine-State Series

Each cell in the matrix above is a summary of a full profile. If your state is in the series, start with the matrix for orientation and then read your profile for the six-dimension detail, the reasoning behind each level, and the deep guides it links out to. Here are all nine, in the order they appear in the comparison:

• Florida Med Spa Regulations at a Glance (2026 Profile) — permissive ownership and broad delegation paired with active, complaint-driven enforcement and a strict laser regime.
• Texas Med Spa Regulations at a Glance (2026 Profile) — strict corporate practice and mandated real supervision alongside broad injector delegation and active enforcement.
• California Med Spa Regulations at a Glance (2026 Profile) — the strict-CPOM archetype: physician-owned structure, real supervision, medical laser, active enforcement.
• New York Med Spa Regulations at a Glance (2026 Profile) — strict ownership and supervision with no med-spa registration regime and active enforcement.
• Georgia Med Spa Regulations at a Glance (2026 Profile) — a middle-tier state built on a physician-delegation and protocol-agreement model with moderate enforcement.
• Arizona Med Spa Regulations at a Glance (2026 Profile) — the most permissive entry in the series, with NP full practice authority and no formal medical-director mandate.
• Ohio Med Spa Regulations at a Glance (2026 Profile) — permissive ownership and broad delegation with laser delegable under oversight and facility licensure.
• Illinois Med Spa Regulations at a Glance (2026 Profile) — strict corporate practice, real supervision, medical laser, and active enforcement.
• Tennessee Med Spa Regulations at a Glance (2026 Profile) — the one state with a dedicated med-spa registration statute, paired with real supervision and broad delegation.

For the deeper cross-category reference with primary sources and every state — not just the nine profiled here — pair this comparison with our flagship med spa regulations by state guide. This page is the at-a-glance comparison; that page is the detailed encyclopedia — built to be used together.

How to Use This Comparison

Practically, work the comparison in three passes. First, find your state and read across its row to see the shape of the whole environment — not just the one dimension you were worried about. Second, if you operate in more than one state, read down each column to see where your locations diverge and where a single playbook will break; ownership and injector scope are where the divergence bites hardest. Third, open the individual profile for any cell that surprised you, because the reasoning behind a level — and the deep guides it links to — is where you turn a characterization into a compliance decision.

Then translate the reading into documents. Every cell in the matrix implies an artifact: an ownership and MSO analysis where the state is strict, a medical director agreement and real-supervision evidence everywhere the director is required, a delegation matrix wherever injectables and laser are delegated, a licensure determination where facility registration applies, and a complete chart set everywhere enforcement is active. A comparison tells you what a state expects; a document set is what you show when it asks. Confirm the current rule with the boards that govern the state your patients are physically located in, and keep the paper trail current — in the active-enforcement states especially, the paperwork is the compliance.

Frequently Asked Questions

This article is for educational purposes only and does not constitute legal or medical advice. Med spa regulations vary by state and change frequently, and the levels above are descriptive characterizations, not scores or legal conclusions. Always confirm current requirements with your state medical board, state board of nursing, and a licensed healthcare attorney before making compliance decisions for your practice.